2080273 - TWCA: Non-critical basicConstraints in Delegated OCSP Responder Certificates

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[TWCA]

Preliminary Incident Report

Summary

• Incident description: TWCA received a third-party report on October 9, 2026, at 20:30 (UTC+08:00), identifying two delegated OCSP responder certificates with a non-critical basicConstraints extension:

  • 70759028-01-GREVSSL2012OCSP (notBefore: 2026-02-24)
  • 70759028-01-CRCAEVSSL2023OCSP (notBefore: 2026-05-08)

  TWCA has verified the finding and confirmed that both certificates contain a non-critical basicConstraints extension, contrary to TLS BR Section 7.1.2.8.2. We are reviewing delegated OCSP responder certificates across our CA hierarchies to determine the full scope of the issue and will replace affected certificates. A full incident report will be provided by October 23, 2026.

• Relevant policies: TLS Baseline Requirements Section 7.1.2.8.2.

• Source of incident disclosure: Third-party report received by TWCA on October 9, 2026, at 20:30 (UTC+08:00).

Comment 1

[Sean Huang (TWCA)]

Attachment: OCSPResponderCertificates.csv

Comment 2

[TWCA]

Full Incident Report

Summary

• CA Owner CCADB unique ID:

  A000054

• Incident description:

  On October 9, 2026, TWCA received a third-party report identifying two OCSP responder certificates containing a non-critical basicConstraints extension, contrary to Section 7.1.2.8.2 of the CA/Browser Forum TLS Baseline Requirements.

  TWCA confirmed the reported issue and reviewed the OCSP responder certificates across its CA hierarchies. Eleven certificates were identified within the scope of this incident.

• Timeline summary:

  • Non-compliance start date:

    September 15, 2023, 08:00, the effective date of TLS BR version 2.0.0 (Ballot SC062), which introduced the OCSP responder certificate profile in Section 7.1.2.8.

    Among the valid affected certificates, the earliest notBefore date is November 26, 2024.

  • Non-compliance identified date:

    October 9, 2026, at 20:30.

  • Non-compliance end date:

    October 14, 2026, 16:20, when the last of the eleven affected certificates was replaced (see Action Item #3).

• Relevant policies:

  TLS BR, version 2.3.1:

  • Section 7.1.2.8.2 — OCSP Responder Extensions.
  • Section 7.1.2.8.4 — OCSP Responder Basic Constraints.

  Under Section 7.1.2.8.2, the basicConstraints extension is optional in the specified OCSP responder certificate profile; however, it must be marked critical when present.

• Source of incident disclosure:

  Third Party Reported.

  TWCA received the initial report on October 9, 2026, at 20:30.

Impact

• Total number of certificates:

  From 2012, when TWCA began providing OCSP services, until the replacements began on 2026-10-12, all of its OCSP responder certificates were issued with a non-critical basicConstraints extension, a setting that has not met the TLS BR requirements since TLS BR version 2.0.0 took effect. TWCA’s inventory identified a total of 26 affected OCSP responder certificates, including expired certificates.

• Total number of "remaining valid" certificates:

  11 OCSP responder certificates.

• Affected certificate types:

  OCSP responder certificates associated with the TLS CA hierarchies.

• Incident heuristic:

  OCSP responder certificates within the applicable TLS BR scope that contain a basicConstraints extension with cA=FALSE where the extension is not marked critical.

• Was issuance stopped in response to this incident, and why or why not?:

  Yes, for OCSP responder certificates only. On October 9, 2026, at 21:30, TWCA suspended all OCSP responder certificate issuance operations until the corrected profile was in place.

  TLS subscriber certificate issuance was not stopped. The issue is limited to the criticality setting of the basicConstraints extension in OCSP responder certificates. It does not affect the profiles of TLS subscriber certificates, and the investigation has not established that the certificate status information provided in OCSP responses was incorrect. TLS subscriber certificate issuance therefore continued as normal.

• Analysis:

  N/A

• Additional considerations:

  The affected corpus includes an OCSP responder certificate associated with TWCA Global Root CA G2, which is used for S/MIME services. TWCA included this certificate in the incident scope in consideration of the cross-certification relationship between TWCA Global Root CA G2 and the TLS-trusted TWCA Global Root CA.

Timeline

All times are UTC+08:00 unless otherwise specified.

Date / Time	Event
2012	TWCA began providing OCSP services. From this time, OCSP responder certificates were issued with a non-critical basicConstraints extension, a setting that became non-compliant when TLS BR version 2.0.0 took effect.
2023-09-15 08:00	TLS BR version 2.0.0 (Ballot SC062) took effect, introducing the OCSP responder certificate profile in Section 7.1.2.8.
2026-10-09 20:30	TWCA received the initial third-party report identifying two OCSP responder certificates.
2026-10-09 21:25	TWCA confirmed that the contents of the Certificate Problem Report were accurate: the reported OCSP responder certificates contain a non-critical basicConstraints extension.
2026-10-09 21:30	The matter was escalated to management, an emergency response was established, and all OCSP responder certificate issuance operations were suspended.
2026-10-10 00:36	TWCA published its Preliminary Incident Report in Bugzilla Bug 2080273.
2026-10-10 00:54	TWCA responded to the reporter.
2026-10-12 10:08	TWCA submitted GitHub Issue #209 and Pull Request #210 to the pkilint project.
2026-10-12 13:00	TWCA held an internal preliminary incident review meeting, attended by the Vice President.
2026-10-12 15:00	TWCA completed the administrative procedure for the OCSP responder certificate profile change.
2026-10-12 18:15	TWCA completed the replacement of three OCSP responder certificates, including the two identified in the Preliminary Incident Report.
2026-10-13 10:00	TWCA completed its inventory of OCSP responder certificates and identified eleven affected certificates, three of which had been replaced on 2026-10-12.
2026-10-14 16:20	TWCA replaced the eight OCSP responder certificates. All eleven affected certificates have been replaced.
2026-10-14 18:20	TWCA verified, by sending OCSP requests to every responder, that all responses are signed by the replacement certificates with a critical basicConstraints extension.

Related Incidents

TWCA reviewed publicly disclosed incidents in the CA Certificate Compliance component and grouped the related incidents into three categories.

1. Incidents identical to this incident (non-critical basicConstraints in OCSP responder certificates)

Bug	Date	Description
2031281	2026-04-13	CFCA reported multiple TLS BR Section 7.1.2.8 deviations in its OCSP responder certificates, including a basicConstraints extension not marked critical (Section 7.1.2.8.2), the same issue as this incident.

2. Other OCSP responder certificate profile incidents

Bug	Date	Description
1996857	2025-10-28	Izenpe reported OCSP responder certificates containing the nonRepudiation key usage, which is not permitted by TLS BR Section 7.1.2.8.7.
2066472	2026-08-25	SECOM reported a discrepancy between Cybertrust Japan's CP/CPS and the actual basicConstraints configuration of its OCSP responder certificates. This was a policy disclosure inconsistency rather than a certificate profile violation.
2080742	2026-10-12	eMudhra reported delegated OCSP responder certificates containing the cRLDistributionPoints extension, which is not permitted by TLS BR Section 7.1.2.8.2.
2080806	2026-10-12	Actalis reported an OCSP responder certificate containing the cRLDistributionPoints extension, together with OCSP responses containing empty singleExtensions.
2081189	2026-10-13	ANF reported potential TLS BR Section 7.1.2.8 violations in an OCSP responder certificate, including the cRLDistributionPoints, certificatePolicies, and authorityInformationAccess extensions and the nonRepudiation key usage.

3. Extension criticality incidents involving other certificates

Bug	Date	Description
1875820	2024-01-22	Telekom Security reported TLS certificates with basicConstraints not marked critical.
1883416	2024-03-04	Certigna reported TLS certificates with basicConstraints not marked critical.
1885132	2024-03-13	TWCA reported TLS certificates issued with a non-critical basicConstraints extension. Following this incident, TWCA added pkilint to its pre-issuance checks. The present incident concerns the same extension setting in OCSP responder certificates.
1886135	2024-03-19	CFCA reported certificates with basicConstraints not marked critical.
1887008	2024-03-22	Hongkong Post reported TLS certificates with basicConstraints not marked critical.
1888060	2024-03-27	GDCA reported TLS certificates with basicConstraints not marked critical.
1888104	2024-03-27	Disig reported a TLS certificate with basicConstraints not marked critical.
1949131	2025-02-19	CFCA reported certificates with basicConstraints not marked critical that had been missed in its earlier revocation for Bug 1886135.

Root Cause Analysis

TWCA reviewed the affected certificate profiles and relevant validation practices to understand how the incorrect extension setting occurred and why it was not identified through the existing verification process.

The findings are summarized in two contributing factors.

Contributing Factor #1: Insufficient Understanding of the OCSP Responder Certificate Profile Requirements

• Description:

  The affected OCSP responder certificates were issued with a basicConstraints extension that was not marked critical.

  The certificate profiles used for these issuances produced an extension setting that did not meet the applicable TLS BR requirement.

  The OCSP responder certificate profile had been in use without change since 2012. When TLS BR version 2.0.0 took effect, TWCA compared the existing profile against the OCSP responder certificate profile newly introduced in TLS BR Section 7.1.2.8, but overlooked the requirement regarding the extension part.

• Timeline:

  • 2012: From 2012, when TWCA began providing OCSP services, its OCSP responder certificates were issued with a non-critical basicConstraints extension.
  • 2023-09-15 08:00: TLS BR version 2.0.0 (Ballot SC062) took effect, introducing the OCSP responder certificate profile in Section 7.1.2.8, which requires the basicConstraints extension, when present, to be marked critical. From this date, this extension setting did not meet the TLS BR requirements.
  • 2024-02-24: The oldest non-compliant OCSP responder certificate was issued.
  • 2026-08-21: The most recent valid non-compliant OCSP responder certificate was issued.

• Detection:

  The issue was first identified through the third-party report received on October 9, 2026.

  TWCA subsequently identified additional OCSP responder certificates with the same issue through its internal investigation.

• Interaction with other factors:

  The incorrect extension criticality setting was not identified by the existing validation controls described in Contributing Factor #2.

• Root Cause Analysis methodology used:

  5 Whys analysis and review of certificate profile requirements.

Contributing Factor #2: Linting Coverage Not Confirmed Against the OCSP Responder Profile Requirements

• Description:

  Following a previous incident involving certificate extension criticality (Bug 1885132), TWCA added pkilint to its pre-issuance checks on 2024-06-24, covering OCSP responder certificates as well as TLS certificates.

  Linting tools are trustworthy and valuable, but their role is supplementary. Each tool determines its own scope of checks, and no linting tool is obligated or guaranteed to detect every requirement. On two occasions, however, TWCA relied on linting results as its primary basis for confirming compliance, rather than as a supplementary check:

  1. After the previous incident: In its review following Bug 1885132, TWCA extended the review to its OCSP responder certificates and checked them with linting tools. Because the checks passed, TWCA relied on that result as the basis for concluding that the profile met the requirements of TLS BR Section 7.1.2.8, and did not check the profile against those requirements item by item.
  2. After CFCA's incident: In its April 2026 self-assessment of Bug 2031281, TWCA judged that the profile deviations reported by CFCA would all be detected by linting tools, and again relied on linting results as the basis for confirming compliance.

  The checks provided by pkilint at that time did not include an extension criticality check for OCSP responder certificates. Because the omission described in Contributing Factor #1 had not been caught, requirements outside the linting coverage, including the criticality of the basicConstraints extension, were never confirmed, and the non-critical basicConstraints extension went undetected.

  TWCA acknowledges that determining the completeness of its compliance verification controls remains its own responsibility. The scope of a linting tool does not alter TWCA's obligation to ensure compliance with applicable requirements.

  TWCA has also proposed this check to the pkilint project through GitHub Issue #209 and Pull Request #210, in the hope that it may also benefit other CAs using pkilint.

• Timeline:

  • 2019-06-26: TWCA began using its self-developed TWCALinter for pre-issuance certificate checks (TLS subscriber certificates only).
  • 2020-07-21: TWCA began using ZLint for pre-issuance certificate checks (TLS subscriber certificates only).
  • 2024-06-24: TWCA began using pkilint for pre-issuance certificate checks, covering CRLs and OCSP responder certificates in addition to TLS certificates.
  • 2026-04-13: CFCA filed Bug 2031281, reporting OCSP responder certificate profile deviations, including a non-critical basicConstraints extension. In its weekly review of the previous week's Bugzilla incidents, TWCA reviewed this incident and documented a self-assessment. The recorded assessment concluded that the profile deviations reported by CFCA would all be detected by linting tools and, because TWCA had already implemented linting, that its certificates were compliant.
  • 2026-10-12 10:08: TWCA submitted pkilint Issue #209 and pkilint Pull Request #210.

• Detection:

  During its investigation of the reported issue, TWCA identified that its linting checks did not cover this requirement.

• Interaction with other factors:

  Because TWCA's verification process did not cover this requirement for OCSP responder certificates, the extension setting described in Contributing Factor #1 was not detected.

• Root Cause Analysis methodology used:

  5 Whys analysis and review of linting coverage against applicable certificate profile requirements.

Root Cause Conclusion

The root cause was that TWCA's confirmation of the OCSP responder certificate profile requirements was not thorough enough. When TLS BR version 2.0.0 took effect, TWCA reviewed the existing profile against TLS BR Section 7.1.2.8, but the review missed the requirement of the extension part. In the 2024 review following Bug 1885132, the OCSP responder certificates were checked with linting tools, and the passing result was relied on as the basis for confirming those requirements; the April 2026 self-assessment of CFCA's incident relied on linting in the same way. Linting tools are meant to be supplementary and cannot replace an item-by-item check against the requirements. As a result, this omission remained undetected.

The pkilint checks added following TWCA's previous incident had improved the detection of certificate compliance issues. However, the specific extension criticality requirement for OCSP responder certificates was not adequately covered by the existing verification process.

TWCA acknowledges this oversight. To address the root cause of this incident, TWCA is strengthening its linting measures and developing a three-way comparison tool that compares the requirements, the CP/CPS, and the issued certificates, rather than relying solely on existing third-party linting tools (Action Item #4).

Lessons Learned

• What went well:

  TWCA's automated Certificate Problem Report monitoring worked as intended.

  The report was received at 20:30 on October 9, 2026, outside business hours and during Taiwan's National Day holiday. The monitoring nevertheless notified the responsible personnel promptly.

• What didn't go well:

  TWCA did not have a specific understanding of the requirements of the OCSP responder certificate profile. Although linting had been effective for TLS certificate profiles, TWCA's comparison of the profile against those requirements missed one of them, and TWCA did not confirm that the same validation approach covered them.

  TWCA relied too heavily on general-purpose linting tools, whose coverage is not determined by TWCA.

• Where we got lucky:

  The technical details provided in the external report facilitated prompt confirmation of the issue.

  The team responded appropriately: after confirming that the report was valid, the matter was immediately escalated to management, and the investigation and preliminary reporting were carried out in a coordinated manner.

• Additional:

  TWCA proposed an extension criticality check for OCSP responder certificates to the pkilint project, through both an issue and a proposed implementation, in the hope that it may also benefit other CAs using pkilint.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
#1. Propose an extension criticality check for OCSP responder certificates to the pkilint project, together with a proposed implementation. Issue #209, PR #210	Detect / Prevent	#2	Open a public GitHub issue proposing the check, and submit a proposed implementation with regression tests for the maintainers' consideration.	2026-10-12	Complete
#2. Complete the affected OCSP responder certificate inventory.	Detect / Mitigate	#1, #2	List the affected certificates in the attached CSV.	2026-10-13	Complete
#3. Fix the OCSP responder certificate profile and replace all affected OCSP responder certificates identified in Action Item #2.	Mitigate	#1	Self-verification: send OCSP requests to the OCSP responders and verify that the responder certificates in the responses are the replacement certificates and that their basicConstraints extension is marked critical.	2026-10-14	Complete
#4. Develop a three-way comparison tool that compares, for each certificate profile, the requirements of the TLS Baseline Requirements, the profile disclosed in TWCA's CP/CPS, and the actual issued certificates, so that profile compliance is verified directly against the requirements rather than relying solely on linting tools. The checking rules are built item by item from the profile tables in the TLS BR, so that every requirement has a corresponding automated check, without depending on the coverage of general-purpose linting tools or on manual field-by-field comparison.	Prevent / Detect	#1, #2	The tool covers all certificate profiles, including OCSP responder certificates, and reports any discrepancy among the TLS BR, the CP/CPS, and the issued certificates. Its effectiveness is validated with a set of intentionally non-compliant test certificates, each covering a different type of profile error (for example, missing, prohibited, or incorrectly encoded fields and extensions, incorrect criticality, and content that differs from the CP/CPS), including the affected OCSP responder certificates listed in the attached CSV. The tool must detect every error in these test certificates.	2026-11-30	Ongoing

Appendix

The following table identifies the eleven affected OCSP responder certificates that were unexpired and unrevoked at the time of the initial report.

Common Name (CN)	SHA-256 Fingerprint
70759028-01-GlobalROOTG2	0191E24BD039EFF4208D555411BF0D9867A673348FCD3CECEEB4217CD6EB45E3
70759028-01-ROOTOCSPResp	0C59AC0ECB064694CE3214CA8E904F54C77AAF03F0075B47B6C88EC27BD797EB
70759028-01-GlobalROOTOCSPResp	8386236BFA7E07620150ED0C810CB735BE87603B3E6B21E4C59FC4A1CC431E29
70759028-01-GREVSSL2012OCSP	D6C716829AD7CD1429BA4EA184E3F65DC692E5779BDED87C4953CD6FC6283723
70759028-01-CRCASSL2024OCSP	77C6CCC62F52E0497EF1739342E4DA1164399A6596FF27F0A6494523EA33BD77
70759028-01-CRCAEVSSL2024OCSP	6CFE6E6B542CF6644E65249E6E9709E24F7343C1C3DA25A404D7F8FBE3031A22
70759028-01-CyberROOT	9097ED114D5BF6A19FCE40EFFB234E91C8CEAF39DF1621AF9B8E8C11806DC57B
70759028-01-SSL2023G3OCSPResp	7915639E4E2276295BD937EF8BCD8FCDAC7ADE932FF4A12651131BEE555BCA7A
70759028-01-CRCASSL2023OCSP	0126B67E65B5D5198D6D2CF6005290B9A26ADB5A194B1A6F8DD2C36FEB0E116C
70759028-01-CRCAEVSSL2023OCSP	97252006C295EBEBFB55022BB7C97A8895600715025F0CA8E3954B172D62945B
70759028-01-GRSSL2023G2OCSP	0C32BDE16625C78646151D2BD98C37C9E0073A744D45397155FFC12706D8BF95

For complete certificate information, please refer to the attached CSV file.

Comment 3

[TWCA]

TWCA has begun developing additional certificate validation checks. As a first step, we are reviewing each certificate profile to identify applicable requirements not covered by our existing linting tools.

We will provide our next progress update before October 29, 2026.